medium6.2
CVE-2026-3778
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF.
Impact
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Foxit | Pdf Editor | through 13.2.2.24014 from 14.0.0.33046 through 14.0.2.33402 from 2023.1.0.15510 through 2023.3.0.23028 from 2024.1.0.23997 through 2024.4.1.27687 from 2025.1.0.27937 through 2025.3.0.35737 through 13.2.2.63349 |
| Foxit | Pdf Reader | through 2025.3.0.35737 through 2025.3.0.69570 |